Merge lp:~yolanda.robla/charms/precise/keystone/unit_testing into lp:~openstack-charmers/charms/precise/keystone/icehouse

[Yolanda Robla]

Added unit testing

[James Page (james-page)]

You need to mock out get_local_endpoint:

======================================================================
ERROR: test_add_service_to_keystone_clustered_https_none_values (unit_tests.test_keystone_utils.TestKeystoneUtils)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/usr/lib/python2.7/dist-packages/mock.py", line 1210, in patched
    return func(*args, **keywargs)
  File "/home/jamespage/src/charms/icehouse/keystone/unit_tests/test_keystone_utils.py", line 158, in test_add_service_to_keystone_clustered_https_none_values
    utils.add_service_to_keystone(relation_id=relation_id, remote_unit=remote_unit)
  File "hooks/keystone_utils.py", line 608, in add_service_to_keystone
    manager = manager.KeystoneManager(endpoint=get_local_endpoint(),
  File "hooks/keystone_utils.py", line 272, in get_local_endpoint
    determine_api_port(api_port('keystone-admin'))
  File "hooks/charmhelpers/contrib/hahelpers/cluster.py", line 122, in determine_api_port
    if len(peer_units()) > 0 or is_clustered():
  File "hooks/charmhelpers/contrib/hahelpers/cluster.py", line 59, in peer_units
    for r_id in (relation_ids('cluster') or []):
  File "hooks/charmhelpers/core/hookenv.py", line 44, in wrapper
    res = func(*args, **kwargs)
  File "hooks/charmhelpers/core/hookenv.py", line 213, in relation_ids
    return json.loads(subprocess.check_output(relid_cmd_line)) or []
  File "/usr/lib/python2.7/subprocess.py", line 566, in check_output
    process = Popen(stdout=PIPE, *popenargs, **kwargs)
  File "/usr/lib/python2.7/subprocess.py", line 710, in __init__
    errread, errwrite)
  File "/usr/lib/python2.7/subprocess.py", line 1327, in _execute_child
    raise child_exception
OSError: [Errno 2] No such file or directory

======================================================================
ERROR: test_add_service_to_keystone_no_clustered_no_https_complete_values (unit_tests.test_keystone_utils.TestKeystoneUtils)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/usr/lib/python2.7/dist-packages/mock.py", line 1210, in patched
    return func(*args, **keywargs)
  File "/home/jamespage/src/charms/icehouse/keystone/unit_tests/test_keystone_utils.py", line 196, in test_add_service_to_keystone_no_clustered_no_https_complete_values
    utils.add_service_to_keystone(relation_id=relation_id, remote_unit=remote_unit)
  File "hooks/keystone_utils.py", line 608, in add_service_to_keystone
    manager = manager.KeystoneManager(endpoint=get_local_endpoint(),
  File "hooks/keystone_utils.py", line 272, in get_local_endpoint
    determine_api_port(api_port('keystone-admin'))
  File "hooks/charmhelpers/contrib/hahelpers/cluster.py", line 122, in determine_api_port
    if len(peer_units()) > 0 or is_clustered():
  File "hooks/charmhelpers/contrib/hahelpers/cluster.py", line 59, in peer_units
    for r_id in (relation_ids('cluster') or []):
  File "hooks/charmhelpers/core/hookenv.py", line 44, in wrapper
    res = func(*args, **kwargs)
  File "hooks/charmhelpers/core/hookenv.py", line 213, in relation_ids
    return json.loads(subprocess.check_ou...

review: Needs Fixing

[lp:~yolanda.robla/charms/precise/keystone/unit_testing]

79. By Yolanda Robla on 2014-04-04

mocking extra calls

80. By Yolanda Robla on 2014-04-04

mocking keystone manager

81. By Yolanda Robla on 2014-04-04

fixing tests for latest changes

[James Page (james-page)]

Looking better; one further comment - Mocks don't have an "assert_called()" method; this works because its a mock but actually fails to check anything - use :

   self.assertTrue(self.<function>.called).

I see a few instances of this throughout the tests.

review: Needs Fixing

[lp:~yolanda.robla/charms/precise/keystone/unit_testing]

82. By Yolanda Robla on 2014-04-04

changing assert_called

=== added file 'unit_tests/test_keystone_contexts.py'
--- unit_tests/test_keystone_contexts.py	1970-01-01 00:00:00 +0000
+++ unit_tests/test_keystone_contexts.py	2014-04-04 12:26:02 +0000
@@ -0,0 +1,70 @@
+import keystone_context as context
+from mock import patch
+
+with patch('charmhelpers.core.hookenv.config') as config:
+    config.return_value = 'keystone'
+    import keystone_utils as utils
+
+from test_utils import (
+    CharmTestCase
+)
+
+TO_PATCH = [
+    'determine_apache_port',
+    'determine_api_port',
+]
+
+
+class TestKeystoneContexts(CharmTestCase):
+
+    def setUp(self):
+        super(TestKeystoneContexts, self).setUp(context, TO_PATCH)
+
+    @patch('charmhelpers.contrib.openstack.context.is_clustered')
+    @patch('charmhelpers.contrib.openstack.context.determine_apache_port')
+    @patch('charmhelpers.contrib.openstack.context.determine_api_port')
+    @patch('charmhelpers.contrib.openstack.context.unit_get')
+    @patch('charmhelpers.contrib.openstack.context.https')
+    def test_apache_ssl_context_service_enabled(self, mock_https,
+                                                mock_unit_get,
+                                                mock_determine_api_port,
+                                                mock_determine_apache_port,
+                                                mock_is_clustered):
+        mock_https.return_value = True
+        mock_unit_get.return_value = '1.2.3.4'
+        mock_determine_api_port.return_value = '12'
+        mock_determine_apache_port.return_value = '34'
+        mock_is_clustered.return_value = False
+
+        ctxt = context.ApacheSSLContext()
+        with patch.object(ctxt, 'enable_modules') as mock_enable_modules:
+            with patch.object(ctxt, 'configure_cert') as mock_configure_cert:
+                self.assertEquals(ctxt(), {'endpoints': [(34, 12)],
+                                           'private_address': '1.2.3.4',
+                                           'namespace': 'keystone'})
+                self.assertTrue(mock_https.called)
+                mock_unit_get.assert_called_with('private-address')
+
+    @patch('charmhelpers.contrib.openstack.context.relation_ids')
+    @patch('charmhelpers.contrib.openstack.context.unit_get')
+    @patch('charmhelpers.contrib.openstack.context.related_units')
+    @patch('charmhelpers.contrib.openstack.context.relation_get')
+    @patch('charmhelpers.contrib.openstack.context.log')
+    @patch('__builtin__.open')
+    def test_haproxy_context_service_enabled(self, mock_open, mock_log, mock_relation_get, mock_related_units,
+                                             mock_unit_get, mock_relation_ids):
+        mock_relation_ids.return_value = ['identity-service:0',]
+        mock_unit_get.return_value = '1.2.3.4'
+        mock_relation_get.return_value = '10.0.0.0'
+        mock_related_units.return_value = ['unit/0',]
+        self.determine_apache_port.return_value = '34'
+
+        ctxt = context.HAProxyContext()
+
+        self.assertEquals(ctxt(), {'listen_ports': {'admin_port': 'keystone', 'public_port': 'keystone'},
+                                   'service_ports': {'admin-port': ['keystone', '34'],
+                                                     'public-port': ['keystone', '34']},
+                                   'units': {'keystone': '1.2.3.4', 'unit-0':'10.0.0.0'}})
+        mock_unit_get.assert_called_with('private-address')
+        mock_relation_get.assert_called_with('private-address', rid='identity-service:0', unit='unit/0')
+        mock_open.assert_called_with('/etc/default/haproxy', 'w')
 
=== modified file 'unit_tests/test_keystone_hooks.py'
--- unit_tests/test_keystone_hooks.py	2014-03-31 08:35:19 +0000
+++ unit_tests/test_keystone_hooks.py	2014-04-04 12:26:02 +0000
@@ -15,6 +15,7 @@
 utils.restart_map = MagicMock()
 
 import keystone_hooks as hooks
+from charmhelpers.contrib import unison
 
 utils.register_configs = _reg
 utils.restart_map = _map
@@ -25,10 +26,14 @@
     'config',
     'is_relation_made',
     'log',
+    'filter_installed_packages',
     'relation_ids',
+    'relation_list',
     'relation_set',
     'relation_get',
+    'related_units',
     'unit_get',
+    'peer_echo',
     # charmhelpers.core.host
     'apt_install',
     'apt_update',
@@ -41,11 +46,20 @@
     'restart_map',
     'register_configs',
     'do_openstack_upgrade',
+    'openstack_upgrade_available',
+    'save_script_rc',
     'migrate_database',
+    'ensure_initial_admin',
+    'add_service_to_keystone',
+    'synchronize_ca',
+    'get_hacluster_config',
+    'is_leader',
     # other
     'check_call',
     'execd_preinstall',
-    'mkdir'
+    'mkdir',
+    'os',
+    'time',
 ]
 
 
@@ -54,7 +68,18 @@
     def setUp(self):
         super(KeystoneRelationTests, self).setUp(hooks, TO_PATCH)
         self.config.side_effect = self.test_config.get
+        self.ssh_user = 'juju_keystone'
 
+    def test_install_hook(self):
+        repo = 'cloud:precise-grizzly'
+        self.test_config.set('openstack-origin', repo)
+        hooks.install()
+        self.configure_installation_source.assert_called_with(repo)
+        self.assertTrue(self.apt_update.called)
+        self.apt_install.assert_called_with(['haproxy', 'unison', 'python-keystoneclient',
+                                             'uuid', 'python-mysqldb', 'openssl', 'apache2',
+                                             'pwgen', 'keystone', 'python-psycopg2'], fatal=True)
+        self.assertTrue(self.execd_preinstall.called)
 
     def test_db_joined(self):
         self.unit_get.return_value = 'keystone.foohost.com'
@@ -76,18 +101,20 @@
 
         with self.assertRaises(Exception) as context:
             hooks.db_joined()
-        self.assertEqual(context.exception.message,
+        self.assertEqual(
+            context.exception.message,
             'Attempting to associate a mysql database when there '
-            'is already associated a postgresql one') 
+            'is already associated a postgresql one')
 
     def test_postgresql_joined_with_db(self):
         self.is_relation_made.return_value = True
 
         with self.assertRaises(Exception) as context:
             hooks.pgsql_db_joined()
-        self.assertEqual(context.exception.message,
+        self.assertEqual(
+            context.exception.message,
             'Attempting to associate a postgresql database when there '
-            'is already associated a mysql one') 
+            'is already associated a mysql one')
 
     @patch.object(hooks, 'CONFIGS')
     def test_db_changed_missing_relation_data(self, configs):
@@ -118,3 +145,222 @@
         configs.complete_contexts.return_value = ['pgsql-db']
         configs.write = MagicMock()
         hooks.pgsql_db_changed()
+
+    @patch.object(hooks, 'CONFIGS')
+    @patch.object(hooks, 'identity_changed')
+    def test_db_changed(self, identity_changed, configs):
+        self.relation_ids.return_value = ['identity-service:0']
+        self.related_units.return_value = ['unit/0']
+
+        self._shared_db_test(configs)
+        self.assertEquals([call('/etc/keystone/keystone.conf')],
+                          configs.write.call_args_list)
+        self.migrate_database.assert_called_with()
+        self.assertTrue(self.ensure_initial_admin.called)
+        identity_changed.assert_called_with(relation_id='identity-service:0', remote_unit='unit/0')
+
+    @patch.object(hooks, 'CONFIGS')
+    @patch.object(hooks, 'identity_changed')
+    def test_postgresql_db_changed(self, identity_changed, configs):
+        self.relation_ids.return_value = ['identity-service:0']
+        self.related_units.return_value = ['unit/0']
+
+        self._postgresql_db_test(configs)
+        self.assertEquals([call('/etc/keystone/keystone.conf')],
+                          configs.write.call_args_list)
+        self.migrate_database.assert_called_with()
+        self.assertTrue(self.ensure_initial_admin.called)
+        identity_changed.assert_called_with(relation_id='identity-service:0', remote_unit='unit/0')
+
+    @patch.object(unison, 'ensure_user')
+    @patch.object(unison, 'get_homedir')
+    @patch.object(hooks, 'CONFIGS')
+    @patch.object(hooks, 'identity_changed')
+    @patch.object(hooks, 'configure_https')
+    def test_config_changed_no_openstack_upgrade_leader(self, configure_https, identity_changed, configs, get_homedir, ensure_user):
+        self.openstack_upgrade_available.return_value = False
+        self.eligible_leader.return_value = True
+        self.relation_ids.return_value = ['identity-service:0']
+        self.relation_list.return_value = ['unit/0']
+
+        hooks.config_changed()
+        ensure_user.assert_called_with(user=self.ssh_user, group='keystone')
+        get_homedir.assert_called_with(self.ssh_user)
+
+        self.save_script_rc.assert_called_with()
+        configure_https.assert_called_with()
+        self.assertTrue(configs.write_all.called)
+
+        self.migrate_database.assert_called_with()
+        self.assertTrue(self.ensure_initial_admin.called)
+        self.log.assert_called_with('Firing identity_changed hook for all related services.')
+        identity_changed.assert_called_with(relation_id='identity-service:0', remote_unit='unit/0')
+
+    @patch.object(unison, 'ensure_user')
+    @patch.object(unison, 'get_homedir')
+    @patch.object(hooks, 'CONFIGS')
+    @patch.object(hooks, 'identity_changed')
+    @patch.object(hooks, 'configure_https')
+    def test_config_changed_no_openstack_upgrade_not_leader(self, configure_https, identity_changed, configs, get_homedir, ensure_user):
+        self.openstack_upgrade_available.return_value = False
+        self.eligible_leader.return_value = False
+
+        hooks.config_changed()
+        ensure_user.assert_called_with(user=self.ssh_user, group='keystone')
+        get_homedir.assert_called_with(self.ssh_user)
+
+        self.save_script_rc.assert_called_with()
+        configure_https.assert_called_with()
+        self.assertTrue(configs.write_all.called)
+
+        self.assertFalse(self.migrate_database.called)
+        self.assertFalse(self.ensure_initial_admin.called)
+        self.assertFalse(identity_changed.called)
+
+    @patch.object(unison, 'ensure_user')
+    @patch.object(unison, 'get_homedir')
+    @patch.object(hooks, 'CONFIGS')
+    @patch.object(hooks, 'identity_changed')
+    @patch.object(hooks, 'configure_https')
+    def test_config_changed_with_openstack_upgrade(self, configure_https, identity_changed, configs, get_homedir, ensure_user):
+        self.openstack_upgrade_available.return_value = True
+        self.eligible_leader.return_value = True
+        self.relation_ids.return_value = ['identity-service:0']
+        self.relation_list.return_value = ['unit/0']
+
+        hooks.config_changed()
+        ensure_user.assert_called_with(user=self.ssh_user, group='keystone')
+        get_homedir.assert_called_with(self.ssh_user)
+
+        self.assertTrue(self.do_openstack_upgrade.called)
+
+        self.save_script_rc.assert_called_with()
+        configure_https.assert_called_with()
+        self.assertTrue(configs.write_all.called)
+
+        self.migrate_database.assert_called_with()
+        self.assertTrue(self.ensure_initial_admin.called)
+        self.log.assert_called_with('Firing identity_changed hook for all related services.')
+        identity_changed.assert_called_with(relation_id='identity-service:0', remote_unit='unit/0')
+
+    def test_identity_changed_leader(self):
+        self.eligible_leader.return_value = True
+        hooks.identity_changed(relation_id='identity-service:0', remote_unit='unit/0')
+        self.add_service_to_keystone.assert_called_with('identity-service:0', 'unit/0')
+        self.assertTrue(self.synchronize_ca.called)
+
+    def test_identity_changed_no_leader(self):
+        self.eligible_leader.return_value = False
+        hooks.identity_changed(relation_id='identity-service:0', remote_unit='unit/0')
+        self.assertFalse(self.add_service_to_keystone.called)
+        self.log.assert_called_with('Deferring identity_changed() to service leader.')
+
+    @patch.object(unison, 'ssh_authorized_peers')
+    def test_cluster_joined(self, ssh_authorized_peers):
+        hooks.cluster_joined()
+        ssh_authorized_peers.assert_called_with(user=self.ssh_user, group='juju_keystone',
+                                                peer_interface='cluster', ensure_local_user=True)
+
+    @patch.object(unison, 'ssh_authorized_peers')
+    @patch.object(hooks, 'CONFIGS')
+    def test_cluster_changed(self, configs, ssh_authorized_peers):
+        hooks.cluster_changed()
+        self.peer_echo.assert_called_with(includes=['_passwd'])
+        ssh_authorized_peers.assert_called_with(user=self.ssh_user, group='keystone',
+                                                peer_interface='cluster', ensure_local_user=True)
+        self.assertTrue(self.synchronize_ca.called)
+        self.assertTrue(configs.write_all.called)
+
+    def test_ha_joined(self):
+        self.get_hacluster_config.return_value = {
+            'ha-bindiface': 'em0',
+            'ha-mcastport': '8080',
+            'vip': '10.10.10.10',
+            'vip_iface': 'em1',
+            'vip_cidr': '24'
+        }
+        hooks.ha_joined()
+        self.assertTrue(self.get_hacluster_config.called)
+        args = {
+            'corosync_bindiface': 'em0',
+            'corosync_mcastport': '8080',
+            'init_services': {'res_ks_haproxy': 'haproxy'},
+            'resources': {'res_ks_vip': 'ocf:heartbeat:IPaddr2',
+                          'res_ks_haproxy': 'lsb:haproxy'},
+            'resource_params': {
+                'res_ks_vip': 'params ip="10.10.10.10"'
+                              ' cidr_netmask="24" nic="em1"',
+                'res_ks_haproxy': 'op monitor interval="5s"'},
+            'clones': {'cl_ks_haproxy': 'res_ks_haproxy'}
+        }
+        self.relation_set.assert_called_with(**args)
+
+    @patch.object(hooks, 'CONFIGS')
+    def test_ha_relation_changed_not_clustered_not_leader(self, configs):
+        self.relation_get.return_value = False
+        self.is_leader.return_value = False
+
+        hooks.ha_changed()
+        self.assertTrue(configs.write_all.called)
+
+    @patch.object(hooks, 'CONFIGS')
+    def test_ha_relation_changed_clustered_leader(self, configs):
+        self.relation_get.return_value = True
+        self.is_leader.return_value = True
+        self.relation_ids.return_value = ['identity-service:0']
+        self.test_config.set('vip', '10.10.10.10')
+
+        hooks.ha_changed()
+        self.assertTrue(configs.write_all.called)
+        self.log.assert_called_with('Cluster configured, notifying other services and updating '
+                                    'keystone endpoint configuration')
+        self.relation_set.assert_called_with(relation_id='identity-service:0',
+                                             auth_host='10.10.10.10',
+                                             service_host='10.10.10.10')
+
+    @patch.object(hooks, 'CONFIGS')
+    def test_configure_https_enable(self, configs):
+        configs.complete_contexts = MagicMock()
+        configs.complete_contexts.return_value = ['https']
+        configs.write = MagicMock()
+
+        hooks.configure_https()
+        self.assertTrue(configs.write_all.called)
+        cmd = ['a2ensite', 'openstack_https_frontend']
+        self.check_call.assert_called_with(cmd)
+
+    @patch.object(hooks, 'CONFIGS')
+    def test_configure_https_disable(self, configs):
+        configs.complete_contexts = MagicMock()
+        configs.complete_contexts.return_value = ['']
+        configs.write = MagicMock()
+
+        hooks.configure_https()
+        self.assertTrue(configs.write_all.called)
+        cmd = ['a2dissite', 'openstack_https_frontend']
+        self.check_call.assert_called_with(cmd)
+
+    @patch.object(unison, 'ssh_authorized_peers')
+    def test_upgrade_charm_leader(self, ssh_authorized_peers):
+        self.eligible_leader.return_value = True
+        self.filter_installed_packages.return_value = []
+        hooks.upgrade_charm()
+        self.assertTrue(self.apt_install.called)
+        ssh_authorized_peers.assert_called_with(user=self.ssh_user, group='keystone',
+                                                peer_interface='cluster', ensure_local_user=True)
+        self.assertTrue(self.synchronize_ca.called)
+        self.log.assert_called_with('Cluster leader - ensuring endpoint configuration'
+                                    ' is up to date')
+        self.assertTrue(self.ensure_initial_admin.called)
+
+    @patch.object(unison, 'ssh_authorized_peers')
+    def test_upgrade_charm_not_leader(self, ssh_authorized_peers):
+        self.eligible_leader.return_value = False
+        self.filter_installed_packages.return_value = []
+        hooks.upgrade_charm()
+        self.assertTrue(self.apt_install.called)
+        ssh_authorized_peers.assert_called_with(user=self.ssh_user, group='keystone',
+                                                peer_interface='cluster', ensure_local_user=True)
+        self.assertTrue(self.synchronize_ca.called)
+        self.assertFalse(self.log.called)
+        self.assertFalse(self.ensure_initial_admin.called)
 
=== added file 'unit_tests/test_keystone_utils.py'
--- unit_tests/test_keystone_utils.py	1970-01-01 00:00:00 +0000
+++ unit_tests/test_keystone_utils.py	2014-04-04 12:26:02 +0000
@@ -0,0 +1,258 @@
+from mock import patch, call, MagicMock
+from test_utils import CharmTestCase
+from copy import deepcopy
+
+from collections import OrderedDict
+import os
+import manager
+
+os.environ['JUJU_UNIT_NAME'] = 'keystone'
+with patch('charmhelpers.core.hookenv.config') as config:
+    import keystone_utils as utils
+
+import keystone_context
+import keystone_hooks as hooks
+from charmhelpers.contrib.openstack import context
+
+TO_PATCH = [
+    'api_port',
+    'config',
+    'create_user',
+    'os_release',
+    'log',
+    'get_ca',
+    'create_role',
+    'create_service_entry',
+    'create_endpoint_template',
+    'get_admin_token',
+    'get_local_endpoint',
+    'get_requested_roles',
+    'get_service_password',
+    'get_os_codename_install_source',
+    'grant_role',
+    'configure_installation_source',
+    'eligible_leader',
+    'https',
+    'is_clustered',
+    'service_stop',
+    'service_start',
+    'relation_get',
+    'relation_set',
+    'https',
+    'unit_private_ip',
+    # generic
+    'apt_update',
+    'apt_upgrade',
+    'apt_install',
+    'subprocess',
+    'time',
+    'pwgen',
+]
+
+class TestKeystoneUtils(CharmTestCase):
+
+    def setUp(self):
+        super(TestKeystoneUtils, self).setUp(utils, TO_PATCH)
+        self.config.side_effect = self.test_config.get
+
+        self.ctxt = MagicMock()
+        self.rsc_map = {
+            '/etc/keystone/keystone.conf': {
+                'services': ['keystone'],
+                'contexts': [self.ctxt],
+            },
+            '/etc/apache2/sites-available/openstack_https_frontend': {
+                'services': ['apache2'],
+                'contexts': [self.ctxt],
+            },
+            '/etc/apache2/sites-available/openstack_https_frontend.conf': {
+                'services': ['apache2'],
+                'contexts': [self.ctxt],
+            }
+        }
+
+    @patch('charmhelpers.contrib.openstack.templating.OSConfigRenderer')
+    @patch('os.path.exists')
+    @patch.object(utils, 'resource_map')
+    def test_register_configs_apache(self, resource_map, exists, renderer):
+        exists.return_value = False
+        self.os_release.return_value = 'havana'
+        fake_renderer = MagicMock()
+        fake_renderer.register = MagicMock()
+        renderer.return_value = fake_renderer
+
+        resource_map.return_value = self.rsc_map
+        utils.register_configs()
+        renderer.assert_called_with(
+            openstack_release='havana', templates_dir='templates/')
+
+        ex_reg = [
+            call('/etc/keystone/keystone.conf', [self.ctxt]),
+            call('/etc/apache2/sites-available/openstack_https_frontend', [self.ctxt]),
+            call('/etc/apache2/sites-available/openstack_https_frontend.conf', [self.ctxt]),
+        ]
+        self.assertEquals(fake_renderer.register.call_args_list, ex_reg)
+
+    def test_determine_ports(self):
+        self.test_config.set('admin-port','80')
+        self.test_config.set('service-port','81')
+        result = utils.determine_ports()
+        self.assertEquals(result, ['80', '81'])
+
+    def test_determine_packages(self):
+        result = utils.determine_packages()
+        ex = utils.BASE_PACKAGES + ['keystone', 'haproxy', 'apache2']
+        self.assertEquals(set(ex), set(result))
+
+    @patch.object(hooks, 'CONFIGS')
+    @patch.object(utils, 'determine_packages')
+    @patch.object(utils, 'migrate_database')
+    def test_openstack_upgrade_leader(self, migrate_database, determine_packages, configs):
+        self.test_config.set('openstack-origin', 'precise')
+        determine_packages.return_value = []
+        self.eligible_leader.return_value = True
+
+        utils.do_openstack_upgrade(configs)
+
+        self.get_os_codename_install_source.assert_called_with('precise')        
+        self.configure_installation_source.assert_called_with('precise')
+        self.assertTrue(self.apt_update.called)
+
+        dpkg_opts = [
+            '--option', 'Dpkg::Options::=--force-confnew',
+            '--option', 'Dpkg::Options::=--force-confdef',
+        ]
+        self.apt_upgrade.assert_called_with(options=dpkg_opts, fatal=True, dist=True)
+        self.apt_install.assert_called_with(packages=[], options=dpkg_opts, fatal=True)
+
+        self.assertTrue(configs.set_release.called)
+        self.assertTrue(configs.write_all.called)
+        self.assertTrue(migrate_database.called)
+
+    def test_migrate_database(self):
+        utils.migrate_database()
+
+        self.service_stop.assert_called_with('keystone')
+        cmd = ['sudo', '-u', 'keystone', 'keystone-manage', 'db_sync']
+        self.subprocess.check_output.assert_called_with(cmd)
+        self.service_start.assert_called_wkth('keystone')
+
+    @patch.object(utils, 'b64encode')
+    def test_add_service_to_keystone_clustered_https_none_values(self, b64encode):
+        relation_id = 'identity-service:0'
+        remote_unit = 'unit/0'
+        self.is_clustered.return_value = True
+        self.https.return_value = True
+        self.test_config.set('https-service-endpoints', 'True')
+        self.test_config.set('vip', '10.10.10.10')
+        self.test_config.set('admin-port', 80)
+        self.test_config.set('service-port', 81)
+        b64encode.return_value = 'certificate'
+        self.get_requested_roles.return_value = ['role1',]
+
+        self.relation_get.return_value = {'service': 'keystone',
+                                          'region': 'RegionOne',
+                                          'public_url': 'None',
+                                          'admin_url': '10.0.0.2',
+                                          'internal_url': '192.168.1.2'}
+
+        utils.add_service_to_keystone(relation_id=relation_id, remote_unit=remote_unit)
+        self.assertTrue(self.is_clustered.called)
+        self.assertTrue(self.https.called)
+        self.assertTrue(self.create_role.called)
+
+        relation_data = {'auth_host': '10.10.10.10',
+                         'service_host': '10.10.10.10',
+                         'auth_protocol': 'https',
+                         'service_protocol': 'https',
+                         'auth_port': 80,
+                         'service_port': 81,
+                         'https_keystone': 'True',
+                         'ca_cert': 'certificate'}
+        self.relation_set.assert_called_with(relation_id=relation_id, **relation_data)
+
+    @patch.object(utils, 'ensure_valid_service')
+    @patch.object(utils, 'add_endpoint')
+    @patch.object(manager, 'KeystoneManager')
+    def test_add_service_to_keystone_no_clustered_no_https_complete_values(self, KeystoneManager, add_endpoint, ensure_valid_service):
+        relation_id = 'identity-service:0'
+        remote_unit = 'unit/0'
+        self.get_admin_token.return_value = 'token'
+        self.get_service_password.return_value = 'password'
+        self.test_config.set('service-tenant', 'tenant')
+        self.test_config.set('admin-role', 'admin')
+        self.get_requested_roles.return_value = ['role1',]
+        self.unit_private_ip.return_value = '10.0.0.3'
+        self.test_config.set('admin-port', 80)
+        self.test_config.set('service-port', 81)
+        self.is_clustered.return_value = False
+        self.https.return_value = False
+        self.test_config.set('https-service-endpoints', 'False')
+        self.get_local_endpoint.return_value = 'http://localhost:80/v2.0/'
+
+        mock_keystone = MagicMock()
+        mock_keystone.resolve_tenant_id.return_value = 'tenant_id'
+        KeystoneManager.return_value = mock_keystone
+
+        self.relation_get.return_value = {'service': 'keystone',
+                                          'region': 'RegionOne',
+                                          'public_url': '10.0.0.1',
+                                          'admin_url': '10.0.0.2',
+                                          'internal_url': '192.168.1.2'}
+
+        utils.add_service_to_keystone(relation_id=relation_id, remote_unit=remote_unit)
+        ensure_valid_service.assert_called_with('keystone')
+        add_endpoint.assert_called_with(region='RegionOne', service='keystone',
+                                        publicurl='10.0.0.1', adminurl='10.0.0.2',
+                                        internalurl='192.168.1.2')
+        self.assertTrue(self.get_admin_token.called)
+        self.get_service_password.assert_called_with('keystone')
+        self.create_user.assert_called_with('keystone', 'password', 'tenant')
+        self.grant_role.assert_called_with('keystone', 'admin', 'tenant')
+        self.create_role.assert_called_with('role1', 'keystone', 'tenant')
+
+        self.assertTrue(self.is_clustered.called)
+        relation_data = {'admin_token': 'token', 'service_port':81,
+                         'auth_port':80, 'service_username':'keystone',
+                         'service_password': 'password', 'service_tenant': 'tenant',
+                         'https_keystone': 'False', 'ssl_cert': '', 'ssl_key': '',
+                         'ca_cert': '', 'auth_host':'10.0.0.3', 'service_host': '10.0.0.3',
+                         'auth_protocol': 'http', 'service_protocol': 'http',
+                         'service_tenant_id': 'tenant_id'}
+        self.relation_set.assert_called_with(relation_id=relation_id, **relation_data)
+
+    @patch.object(utils, 'ensure_valid_service')
+    @patch.object(utils, 'add_endpoint')
+    @patch.object(manager, 'KeystoneManager')
+    def test_add_service_to_keystone_nosubset(self, KeystoneManager, add_endpoint, ensure_valid_service):
+        relation_id = 'identity-service:0'
+        remote_unit = 'unit/0'
+
+        self.relation_get.return_value = {'ec2_service': 'nova',
+                                          'ec2_region': 'RegionOne',
+                                          'ec2_public_url': '10.0.0.1',
+                                          'ec2_admin_url': '10.0.0.2',
+                                          'ec2_internal_url': '192.168.1.2'}
+        self.get_local_endpoint.return_value = 'http://localhost:80/v2.0/'
+        KeystoneManager.resolve_tenant_id.return_value = 'tenant_id'
+
+        utils.add_service_to_keystone(relation_id=relation_id, remote_unit=remote_unit)
+        ensure_valid_service.assert_called_with('nova')
+        add_endpoint.assert_called_with(region='RegionOne', service='nova',
+                                             publicurl='10.0.0.1', adminurl='10.0.0.2',
+                                             internalurl='192.168.1.2')	
+
+    def test_ensure_valid_service_incorrect(self):
+        utils.ensure_valid_service('fakeservice')
+        self.log.assert_called_with("Invalid service requested: 'fakeservice'")
+        self.relation_set.assert_called_with(admin_token=-1)
+
+    def test_add_endpoint(self):
+        publicurl = '10.0.0.1'
+        adminurl = '10.0.0.2'
+        internalurl = '10.0.0.3'
+        utils.add_endpoint('RegionOne', 'nova', publicurl, adminurl, internalurl)
+        self.create_service_entry.assert_called_with('nova', 'compute', 'Nova Compute Service')
+        self.create_endpoint_template.asssert_called_with(region='RegionOne', service='nova',
+                                                          publicurl=publicurl, adminurl=adminurl,
+                                                          internalurl=internalurl)